How to set the retention period of event log in the event viewer in days.

Question

How to set the retention period of event log in the event viewer in days.

PRAKASH Ayush 0

I am currently working with Windows Server 2022 and I need assistance in adjusting the event log settings. Specifically, I would like to set a retention policy for event logs with a particular log name to be based on a specified number of days, rather than by size. I want the event logs that are older than this defined period to be cleared automatically by Event Viewer.

Is there a way to achieve this within Event Viewer? If there are any alternative methods or approaches to implement a days-based retention policy for event logs, I would greatly appreciate your guidance.

Also, I found the below reference which might be of use regarding this query, so kindly explain how use the method given in the reference if it is related to my query.

https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-gpsb/0b9673a7-ce0a-49b4-912b-591efdb37cdf

Jose Benjamin Solis Nolasco 1,146 Reputation points

2025-03-18T14:26:46.0833333+00:00
In my experience the best way is using a Powershell script

You can create a scheduled task that runs a PowerShell script to delete event logs older than a certain number of days.

PowerShell Script

The following script will remove events older than 30 days from the specified log (e.g., "Application"):

powershell CopyEdit $LogName = "Application" # Change to your desired log (e.g., Security, System, etc.) $Days = 30 # Define retention period in days $OldEvents = Get-WinEvent -LogName $LogName -MaxEvents 100000 | Where-Object { $_.TimeCreated -lt (Get-Date).AddDays(-$Days) } foreach ($Event in $OldEvents) { [System.Diagnostics.EventLog]::DeleteEventSource($Event.ProviderName) }

Steps to Implement This Script

Open Notepad and copy the script above.

Save it as ClearOldEventLogs.ps1 in a secure location (C:\Scripts\).

Open Task Scheduler (taskschd.msc).

Click Create Basic Task.

Set a name like "Clear Old Event Logs".

Choose Daily and set the time to run.

Select Start a Program, then enter:

Program/Script: powershell.exe

Arguments: -ExecutionPolicy Bypass -File C:\Scripts\ClearOldEventLogs.ps1

Click Finish.

This task will now run daily and delete logs older than 30 days.

I hope this clarifies things.

Please remember to "Accept Answer", so that others in the community facing similar issues can easily find the answers.
PRAKASH Ayush 0 Reputation points

2025-03-18T15:12:37.85+00:00

Hello Jose Benjamin Solis Nolasco, I tried the approach suggested by you but it didnt clear the older logs, I modified the powershell script for logname = NCM and days = 5.And ran the script on powershell with the command "-ExecutionPolicy Bypass -File filepath\EventLogs.ps1".

The below image is taken after I ran the script. Kindly let me know where it might have gone wrong.

Jose Benjamin Solis Nolasco 1,146

Try this updated script:

powershell
CopyEdit
$LogName = "NCM"  # Change this to your log name
$Days = 5  # Define retention period in days

# Export old events for backup before deletion
$BackupPath = "C:\Logs\OldEvents_$LogName.evtx"
wevtutil epl $LogName $BackupPath

# Filter and clear the event log
$OldEvents = Get-WinEvent -LogName $LogName | Where-Object { $_.TimeCreated -lt (Get-Date).AddDays(-$Days) }

if ($OldEvents) {
    wevtutil cl $LogName
    Write-Host "Old events cleared successfully from $LogName."
} else {
    Write-Host "No events older than $Days days were found in $LogName."
}

Explanation of Fixes:

Backs up logs before deletion (in case you need to restore them).
Clears the entire log if there are events older than 5 days.
Uses wevtutil cl to remove logs since Get-WinEvent does not support selective deletion.

Let me know if this helps you, I just made a little modification worked for me on my end.

PRAKASH Ayush 0 Reputation points

2025-03-18T15:42:35.5866667+00:00

Jose Benjamin Solis Nolasco, the command "wevtutil cl $LogName" when ran at any instance will clear all the log with logname 'NCM'. So due to this the newer which are supposed to be displayed will also be cleared.
PRAKASH Ayush 0 Reputation points

2025-03-19T07:48:30.62+00:00

Hello @Jose Benjamin Solis Nolasco kindly let me know your insight on the above comment.

1 answer

Your answer

Jose Benjamin Solis Nolasco 1,146 Reputation points

2025-03-18T14:26:46.0833333+00:00

In my experience the best way is using a Powershell script

You can create a scheduled task that runs a PowerShell script to delete event logs older than a certain number of days.

PowerShell Script

The following script will remove events older than 30 days from the specified log (e.g., "Application"):

powershell CopyEdit $LogName = "Application" # Change to your desired log (e.g., Security, System, etc.) $Days = 30 # Define retention period in days $OldEvents = Get-WinEvent -LogName $LogName -MaxEvents 100000 | Where-Object { $_.TimeCreated -lt (Get-Date).AddDays(-$Days) } foreach ($Event in $OldEvents) { [System.Diagnostics.EventLog]::DeleteEventSource($Event.ProviderName) }

Steps to Implement This Script

Open Notepad and copy the script above.

Save it as ClearOldEventLogs.ps1 in a secure location (C:\Scripts\).

Open Task Scheduler (taskschd.msc).

Click Create Basic Task.

Set a name like "Clear Old Event Logs".

Choose Daily and set the time to run.

Select Start a Program, then enter:

Program/Script: powershell.exe

Arguments: -ExecutionPolicy Bypass -File C:\Scripts\ClearOldEventLogs.ps1

Click Finish.

This task will now run daily and delete logs older than 30 days.

I hope this clarifies things.

Please remember to "Accept Answer", so that others in the community facing similar issues can easily find the answers.
PRAKASH Ayush 0 Reputation points

2025-03-18T15:12:37.85+00:00

Hello Jose Benjamin Solis Nolasco, I tried the approach suggested by you but it didnt clear the older logs, I modified the powershell script for logname = NCM and days = 5.And ran the script on powershell with the command "-ExecutionPolicy Bypass -File filepath\EventLogs.ps1".

The below image is taken after I ran the script. Kindly let me know where it might have gone wrong.
Jose Benjamin Solis Nolasco 1,146 Reputation points

2025-03-18T15:30:30.0366667+00:00

Try this updated script:

powershell CopyEdit $LogName = "NCM" # Change this to your log name $Days = 5 # Define retention period in days # Export old events for backup before deletion $BackupPath = "C:\Logs\OldEvents_$LogName.evtx" wevtutil epl $LogName $BackupPath # Filter and clear the event log $OldEvents = Get-WinEvent -LogName $LogName | Where-Object { $_.TimeCreated -lt (Get-Date).AddDays(-$Days) } if ($OldEvents) { wevtutil cl $LogName Write-Host "Old events cleared successfully from $LogName." } else { Write-Host "No events older than $Days days were found in $LogName." }

Explanation of Fixes:

Backs up logs before deletion (in case you need to restore them).

Clears the entire log if there are events older than 5 days.

Uses wevtutil cl to remove logs since Get-WinEvent does not support selective deletion.

Let me know if this helps you, I just made a little modification worked for me on my end.
PRAKASH Ayush 0 Reputation points

2025-03-18T15:42:35.5866667+00:00

Jose Benjamin Solis Nolasco, the command "wevtutil cl $LogName" when ran at any instance will clear all the log with logname 'NCM'. So due to this the newer which are supposed to be displayed will also be cleared.
PRAKASH Ayush 0 Reputation points

2025-03-19T07:48:30.62+00:00

Hello @Jose Benjamin Solis Nolasco kindly let me know your insight on the above comment.

Answer 1

Ian Xue-MSFT 41,716 Microsoft External Staff

Hi,

You can open Task Scheduler and create a scheduled task that runs periodically. Add a new trigger and configure the "Repeat task every" setting under advanced settings. In the Actions tab, run the command wevtutil cl <Logname> to clear the specified log.

Best Regards,

Ian Xue

If the Answer is helpful, please click "Accept Answer" and upvote it.

PRAKASH Ayush 0 Reputation points

2025-03-19T07:44:34.4066667+00:00

Hello @Ian Xue-MSFT , Correct me if I am wrong but the command "wevtutil cl LogName" when ran at any instance will clear all the log with that specific logname. So due to this the newer logs which are supposed to be displayed will also be cleared from the event viewer.
PRAKASH Ayush 0 Reputation points

2025-03-19T07:54:39.07+00:00

, I have seen your answer for the query

https://learn.microsoft.com/en-us/answers/questions/1326372/how-to-set-event-log-retention-by-days-instead-of?page=1&orderby=helpful&comment=answer-1283847&translated=false

This answer is valid for active directory, is it possible achieve the same with the local directories as well and also give your insights if there is any other way to resolve the query.

Share via

How to set the retention period of event log in the event viewer in days.

1 answer

Your answer